Explore, live tail and patterns

Explore is where you search logs in Logthread: type a query, narrow it with filters and a time range, and open any event to see all of its fields. Live tail streams events as they arrive, and Patterns groups recurring messages. You can keep a query as a saved search and rerun it any time. Every role, including viewers, can use these pages.

Work in tabs#

Explore keeps your searches in tabs along the top. Each tab holds one search: its query, time range, columns and view.

• + New opens a new, empty tab with the cursor in the query box. An empty tab reads nothing: Logthread never fetches every log because the box is empty, and Enter on an empty box does nothing. Instead, it offers starting points from your own data: sample searches, your recent searches and saved searches. Click a tab to switch to it; the tab's search comes back exactly as you left it, and the page address always shows the active tab's search, so Share this view and reloading keep working.
• A tab is named after its query (hover for the full text), or New search while it is empty. Double-click a tab to give it your own name; clear the name to go back to the query.
• Close a tab with its x, a middle-click, or Delete while it has focus. Use the left and right arrow keys to move between tabs.
• A link to a search that no tab has (a shared link, a link from another page or from Pari) opens in a new tab. A search a teammate shares with you (Share with teammates) is added to your tabs as "From <name>: …" without switching to it. A tab can hold at most 20 searches per workspace, and your tabs are remembered in this browser.
• Only the tab you are looking at runs queries. Switching back to a tab you just left shows its results straight away.

The first tab, Home, lists your open tabs, each with its query, time range, match count and when it last ran. Counts come from what the tab already loaded, so Home never runs a search. Open, Duplicate or close a tab from there, Close all, or start a New search from a few ideas built from your own data.

Search your logs#

Open Explore and type in the one search box (press / to jump to it). It takes filters, free text and, after a |, pipe stages, all in the same text.

• Plain words match the message or any attribute value: checkout timeout finds lines that contain both words, in any order, and bulbul finds lines with model=bulbul:v4-flash. When a word is in a field, a line above the results says where ("bulbul is in no message, only in model") and offers the exact filter, such as model:bulbul:v4-flash, in one click. While you type a word of 3 or more letters, the suggestions include those filters with their line counts. An exact filter finds the same lines faster and works the same way in alerts and dashboards. When a line matched on a field rather than its message, the row shows that field and value before the message (for example model=bulbul:v4-flash), in Explore and in live tail. Quote a phrase to match it exactly: "timed out". Live tail matches the same way.
• field:value filters on a field: service:api, -severity:debug, http.status:500.
• severity:(error|warn) matches several values.
• Filters, values, quoted text, numbers, the | and stage names each have their own color, so you can see how Logthread reads the query.
• Suggestions follow the cursor: fields and their values before the first |, stages, functions and fields after it. Move with the arrow keys and press Tab to accept one.
• Enter runs the search. Shift+Enter adds a new line, and the box grows with your text.

Everything before the first | is the selector. The full syntax, including parse and aggregate stages, is on the query language page.

Search in KQL or SQL#

Each tab has a language switch next to the search box: LTQL (the Logthread Query Language, the default), KQL or SQL. Switching starts a new, empty query in that language.

• In KQL or SQL the tab shows a query editor; press Run or Ctrl/Cmd+Enter. Results come back as a table, and as a chart when they have a time column and a number.
• The tab's time range applies: in KQL it is added after the first table (logs, spans, metrics_sum, ...), in SQL bind it with {from:DateTime64(3)} and {to:DateTime64(3)}.
• Tabs, sharing links and Export (NDJSON for KQL) work as for any search. The tab name starts with KQL · or SQL ·.
• Open in SQL page takes the query to the SQL page for parameters, saved queries and the schema browser. Querying in KQL or SQL needs the member role. The rules are on the SQL console page, and the verified KQL constructs on the KQL page.

Add pipe stages#

Type | after your filters, then a stage. Stages can parse the message, filter on parsed fields and aggregate, one per line if you like:

service:api -severity:debug
| json
| where duration_ms > 500
| stats count() by route

Enter (or Ctrl/Cmd+Enter) runs the query. If a stage has a mistake, the search box underlines it and says which line and column. The Query syntax button next to the box lists the stages, functions and examples. Parsed fields appear in the event detail under Parsed. If a query ends in an aggregate such as stats, the results show as a table instead of a list of events.

Workspace admins can turn a query you like into an ingest pipeline with the save-as-pipeline button beside the search box. See Pipelines and parsing.

Charts#

When the numbers in a stats result can be plotted, a chart appears above the table, with a switcher in its top bar:

• Binned by time (by bin(ts, 5m)): Line, Area or Stacked bars. Add , service to draw one series per service.
• Grouped (stats count() by level): Bar or Horizontal bar (the default with more than 8 values or long labels). A single measure can also be a Donut when no value is negative; beyond 12 slices the smallest are summed as Other. Two group fields (by service, level) draw grouped or stacked bars, one series per value of the second field.
• One value (stats count()): a big number, one tile per measure.

With several measures (stats count(), avg(duration_ms) by service) a picker chooses which one to plot. Table shows the table only, and the table below the chart can be collapsed. Tooltips show exact values and axes use short labels such as 1.2k. The chosen type is saved in the page address (chart=), so a shared link opens the same chart. Results with no numeric column show only the table.

Choose a time range#

The time picker next to the toolbar has:

• Presets: Last 5 minutes, Last 15 minutes, Last 1 hour, Last 4 hours, Last 24 hours, Last 2 days, Last 7 days.
• A text box: type 30m, last 2d or <date> to <date>.
• An Absolute range (local time) with From and To, then Apply.
• Arrows to move to an earlier or later window (Shift+Left / Shift+Right).

A search in Explore covers at most 7 days at a time. The AI agent tools (search_logs, count_logs) and the search API page back through your whole retention.

Read the histogram#

The bar chart above the results shows events over time, stacked by severity.

• Drag across it to zoom into that period.
• Click a bar to focus that bucket; Shift-click to also filter on that bar's severity.
• Press Zoom out (or -) to widen the range again.

Filter with the field sidebar#

Click the panel button at the left of the toolbar (Toggle facets panel) to show or hide the sidebar.

• Service and Severity list the values in the current results with counts. Click a value to show only that value; use the x beside it to exclude it. Alt-click also excludes.
• Fields lists the attributes found in the range. Type in Search fields to find one, then expand it to see its top values and click to filter.
• If the range is large the list may be marked as sampled or approximate.

Open an event#

Click a row, or select it with j / k (or the arrow keys) and press Enter or o.

• Fields tab: parsed fields, the event's core fields, Attributes and Resource. Each field has actions to filter on it, add it as a column and copy it.
• JSON and Raw tabs: the event as JSON, and the message as stored.
• Context tab (Show context): events around this one.
• Open trace appears when the event has a trace id.
• [ and ] move to the previous and next event; Esc closes the details.

Use Columns to choose which columns the list shows. Use as my default here makes new searches start with your columns.

Follow a request across services#

Click Show full story, or Story in an event's details. Logthread takes the correlation ids on the lines you matched and shows every event that shares them, across all services, as one timeline per request.

• Each story card shows the correlation id, the services in order of first appearance, the duration and how many events matched your search.
• First error jumps to the first error in that request.
• Use the button next to the id to filter Explore to it, or open the trace when there is one.
• Keys: n and p move between stories, o expands one.
• Maximum stories sets how many requests are shown.

Matched lines with no correlation id cannot be joined to a story. Workspace admins can add their own ids under Settings, Correlation; rules apply to newly ingested data only.

Find a request by its id#

When a customer gives you a request id, an order id or a trace id, you do not need to know which field holds it.

• In Explore, type req:<id> in the query box and press Enter, or paste the id into Find request on the Home page.
• Either one opens the id's thread:
• every line, across all services, where the id is an attribute value, the trace or span id, or a whole word in the message;
• those lines grouped into steps, with a lane per service;
• the first error;
• the traces found;
• the other ids on the same lines, which you can follow.
• In a log's details, the thread icon next to a field value opens that value's thread.

req:<id> opens the thread only when it is the whole query. Combined with other terms, req is searched as an ordinary attribute name.

Save a search#

1. Build the query, filters and time range.
2. Click Save, enter a Name (up to 120 characters) and choose Visibility.
3. Click Save.

The saved-searches button (Saved tab) lists your searches and shared ones. Click one to load it; use the pencil to edit or the bin to delete. The History tab keeps your recent searches, and Clear history empties it.

Other things you can do from Explore#

• Create alert: start a scheduled-search alert from the current search (members and above). Pipe stages are not included.
• Add to dashboard: add the search as a dashboard panel (members and above).
• Export: download the results.
• Live (in Explore): refresh every 10 seconds on a relative range.

Watch logs live#

Open Live tail and type what to watch, such as service:checkout or severity:error. It streams matching events as they arrive. With an empty filter nothing streams; the page offers filters built from your services instead. Nothing is stored by the tail, so use Explore for history.

• Filter by service, severity and text. Other filters are ignored and a notice tells you. Pipe stages and parsed fields are not computed in live tail.
• Pause (or press Space) stops the view; arriving events are buffered and the pill shows how many. Resume brings them in.
• Scroll up to stop following; Jump to latest takes you back.
• The page keeps the latest 50,000 rows and shows the rate in rows per second.
• If events arrive faster than your workspace's tail budget allows, some are skipped and the dropped counter shows how many.
• The tail reconnects on its own if the connection drops. Up to 10 streams per workspace can run at once.
• Click a row to expand it; Open in Explore (+/- 5 min) jumps to that moment.
• The link beside Clear opens the same query over the last 15 minutes in Explore.

Find recurring messages#

Open Patterns. Logthread groups similar messages into a template (variable parts replaced) and shows the count, a trend and the change against the previous equal window.

• Tabs: All, New (first seen in the range), Rising (more than the previous window), Errors and Same time daily.
• Same time daily looks at the last 7 days, whatever range you picked, and lists errors and warnings that come back at the same time of day, with the days and the time in UTC. A pattern is listed when at least 4 days have it, at least 10 events and 60% of its events fall inside one window of up to 3 hours. One-off incidents and steady errors are left out.
• Filter by service, severity and text; pick a time range.
• Explore opens the events of a pattern in Explore. Members and above can create an Alert on a pattern or add its volume to a Dashboard.
• CSV downloads the listed patterns (id, service, template, counts, change and severity mix).
• Compare looks at two windows and lists patterns that Appeared, Disappeared, Increased or Decreased.

Keyboard shortcuts#

Next: learn the query language that powers the search box.